{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Lab 1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Business Understanding"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "collapsed": true
   },
   "source": [
    "### Describe the purpose of the data set you selected \n",
    "- *Why was this data collected in the first place?* - The data set selected is the \"UNSW_NB15\" network traffic data set. The data set was created to evalutate Network Intrusion Detection Systems (NIDS). According to the creators of the data set, N. Moustafa and J. Slay from the Australian Defence Force Academy, the \"quality of a NIDS data set reflects two important characteristics: comprehensive reflection of contemporary threats and an inclusive normal range of traffic [1].\" Before this data set was generated, they argued that existing data sets used to train and test NIDS were not representative of current traffic flows and threats.\n",
    "- Describe how you would define and measure the outcomes from the dataset. That is: \n",
    "    - *Why is this data important?* - The importance of this data set is that it will allow NIDS to be evaluted better, which will increase their performance, increase their protective power and reduce the chance of false positives and false negatives.\n",
    "    - *How do you know if you have mined useful knowledge from the dataset?* - We will know we mined useful knowledge from the data set if we can determine, based on a collection of packets of traffic data, whether the features of those packets indicate an attack or just normal traffic.\n",
    "    - *How would you measure the effectiveness of a good prediction algorithm? Be specific.* - Finding a model that predicts from the network traffic whether an attack is occuring or not, and, if there is an attack, which category of attack if occuring, will measure the effectiveness of the model. Determining if an attack is occuring is the basis of the model and with refinement, we will try to search for categorizing the attack."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Data Understanding"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "collapsed": false
   },
   "outputs": [],
   "source": [
    "# Imports\n",
    "from pandas.tools.plotting import scatter_matrix\n",
    "import pandas as pd\n",
    "import numpy  as np\n",
    "import seaborn as sns\n",
    "import matplotlib.pyplot as plt\n",
    "import warnings\n",
    "warnings.simplefilter('ignore', DeprecationWarning)\n",
    "pd.set_option('display.max_columns', None)    # set the max columns to show to unlimited\n",
    "\n",
    "%matplotlib inline"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# Load UNSW_NB15 into a Pandas dataframe\n",
    "df = pd.read_csv('UNSW_NB15_training_set.csv')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Describe the meaning and type of data (scale, values, etc.) for each attribute in the data file."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## UNSW_NB15_training_set\n",
    "- A Network Intrusion Data Set.\n",
    "    - 82332 rows x 45 columns\n",
    "        - **id** *int* The id of the record\n",
    "        - **dur** *float* Record's total duration\n",
    "        - **proto** *Nominal* Tranaction Protocol\n",
    "        - **service** *Nominal* http, ftp, ssh, dns, ..., else(-)\n",
    "        - **state** *Nominal* The state and its dependent protocol e.g. ACC, CLO, FIN, INT, ..., else (-)\n",
    "\t\t- **spkts** *int* Source to destination packet count\n",
    "\t\t- **dpkts** *int* Destination to source packet count \n",
    "\t\t- **sbytes** *int* Source to destination bytes\n",
    "\t\t- **dbytes** *int* Destination to source bytes\n",
    "\t\t- **rate** *float* We were unable to find a description of rate. It does contain outliers, but we were unable to find reason to throw it out. So we kept it at any *rate*\n",
    "\t\t- **sttl** *int* Source to destination bytes\n",
    "\t\t- **dttl** *int* Destination to source time to live\n",
    "\t\t- **sload** *float* Source bits per second\n",
    "\t\t- **dload** *float* Destination bits per second\n",
    "\t\t- **sloss** *int* Source packets retransmitted or dropped\n",
    "\t\t- **dloss** *int* Destination packets retransmitted or dropped\n",
    "\t\t- **sinpkt** *float* Source inter-packet arrival time(mSec)\n",
    "\t\t- **dinpkt** *float* Destination inetr-packet arrival time(mSec)\n",
    "\t\t- **sjit** *float* Source jitter (mSec)\n",
    "\t\t- **djit** *float* Destination jitter(mSec)\n",
    "\t\t- **swin** *int* Source TCP window advertisment\n",
    "\t\t- **stcpb** *int* Source TCP sequence number\n",
    "\t\t- **dtcpb** *int* Destination TCP sequence number\n",
    "\t\t- **dwin** *int* Destination TCP window advertisment\n",
    "\t\t- **tcprtt** *float* The sum of 'synack' and 'ackdat' of the TCP\n",
    "\t\t- **synack** *float* The time between the SYN and the SYN_ACK packets of the TCP\n",
    "\t\t- **ackdat** *float* The time between the SYN_ACK and the ACK packets of the TCP\n",
    "\t\t- **smean** *int* Mean of the flow packet size transmitted by the sre\n",
    "\t\t- **dmean** *int* Mean of the flow packet size transmitted by the dst\n",
    "\t\t- **trans_depth** *int* The depth into the connection of the http request/response transaction\n",
    "\t\t- **response_body_len** *int* The content size of the data transferred from the server's http service\n",
    "\t\t- **ct_srv_src** *int* No. of Connection that contain the same service (14) and source address in 100 connections according to the last time\n",
    "\t\t- **ct_state_ttl** *int* No. for each state (6) according to specific range if value for source/destination time to live\n",
    "\t\t- **ct_dst_ltm** *int* No of connectiuon of the same destination address (3) in 100 connections according to the last time\n",
    "\t\t- **ct_src_dport_ltm** *int* No. of connection of the same source address and the destination port in 100 connections according to the last time\n",
    "\t\t- **ct_dst_sport_ltm** *int* No. of connnection of the same destination address(3) and the source port (2) in 100 connection according to the last time (26).\n",
    "\t\t- **ct_dst_src_ltm** *int* No connection of the same cource (1) and the destination (3) address in 100 connection according to the last time (26)\n",
    "\t\t- **is_ftp_login** *byte* If the ftp session is accessed by user and password then 1 else 0\n",
    "\t\t- **ct_ftp_cmd** *int* No. of flows that has a command in ftp session\n",
    "\t\t- **ct_flw_http_mthd** *int* No. of flows that has methof such as Get and Post in http service\n",
    "\t\t- **ct_src_ltm** *int* No of connections of the same source address (1) in 100 connection according to the last time(26).\n",
    "\t\t- **ct_srv_dst** *int* No. of connectio that conbtain the same service and destination address in 100 connection according to the last time\n",
    "\t\t- **is_sm_ips_ports** *byte* If source equals to destination (3) IP addresses and port numbers (2)(4) are equal, this variable takes value 1 else 0\n",
    "\t\t- **attack_cat** *Nominal* The name of each attack category. In this data set, nine categories (e.g. Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode and Worms)\n",
    "\t\t- **label** *byte* 0 for normal and 1 for attack records"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<class 'pandas.core.frame.DataFrame'>\n",
      "RangeIndex: 82332 entries, 0 to 82331\n",
      "Data columns (total 45 columns):\n",
      "﻿id                  82332 non-null int64\n",
      "dur                  82332 non-null float64\n",
      "proto                82332 non-null object\n",
      "service              82332 non-null object\n",
      "state                82332 non-null object\n",
      "spkts                82332 non-null int64\n",
      "dpkts                82332 non-null int64\n",
      "sbytes               82332 non-null int64\n",
      "dbytes               82332 non-null int64\n",
      "rate                 82332 non-null float64\n",
      "sttl                 82332 non-null int64\n",
      "dttl                 82332 non-null int64\n",
      "sload                82332 non-null float64\n",
      "dload                82332 non-null float64\n",
      "sloss                82332 non-null int64\n",
      "dloss                82332 non-null int64\n",
      "sinpkt               82332 non-null float64\n",
      "dinpkt               82332 non-null float64\n",
      "sjit                 82332 non-null float64\n",
      "djit                 82332 non-null float64\n",
      "swin                 82332 non-null int64\n",
      "stcpb                82332 non-null int64\n",
      "dtcpb                82332 non-null int64\n",
      "dwin                 82332 non-null int64\n",
      "tcprtt               82332 non-null float64\n",
      "synack               82332 non-null float64\n",
      "ackdat               82332 non-null float64\n",
      "smean                82332 non-null int64\n",
      "dmean                82332 non-null int64\n",
      "trans_depth          82332 non-null int64\n",
      "response_body_len    82332 non-null int64\n",
      "ct_srv_src           82332 non-null int64\n",
      "ct_state_ttl         82332 non-null int64\n",
      "ct_dst_ltm           82332 non-null int64\n",
      "ct_src_dport_ltm     82332 non-null int64\n",
      "ct_dst_sport_ltm     82332 non-null int64\n",
      "ct_dst_src_ltm       82332 non-null int64\n",
      "is_ftp_login         82332 non-null int64\n",
      "ct_ftp_cmd           82332 non-null int64\n",
      "ct_flw_http_mthd     82332 non-null int64\n",
      "ct_src_ltm           82332 non-null int64\n",
      "ct_srv_dst           82332 non-null int64\n",
      "is_sm_ips_ports      82332 non-null int64\n",
      "attack_cat           82332 non-null object\n",
      "label                82332 non-null int64\n",
      "dtypes: float64(11), int64(30), object(4)\n",
      "memory usage: 28.3+ MB\n"
     ]
    }
   ],
   "source": [
    "df.info()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {
    "collapsed": false,
    "scrolled": true
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>﻿id</th>\n",
       "      <th>dur</th>\n",
       "      <th>spkts</th>\n",
       "      <th>dpkts</th>\n",
       "      <th>sbytes</th>\n",
       "      <th>dbytes</th>\n",
       "      <th>rate</th>\n",
       "      <th>sttl</th>\n",
       "      <th>dttl</th>\n",
       "      <th>sload</th>\n",
       "      <th>dload</th>\n",
       "      <th>sloss</th>\n",
       "      <th>dloss</th>\n",
       "      <th>sinpkt</th>\n",
       "      <th>dinpkt</th>\n",
       "      <th>sjit</th>\n",
       "      <th>djit</th>\n",
       "      <th>swin</th>\n",
       "      <th>stcpb</th>\n",
       "      <th>dtcpb</th>\n",
       "      <th>dwin</th>\n",
       "      <th>tcprtt</th>\n",
       "      <th>synack</th>\n",
       "      <th>ackdat</th>\n",
       "      <th>smean</th>\n",
       "      <th>dmean</th>\n",
       "      <th>trans_depth</th>\n",
       "      <th>response_body_len</th>\n",
       "      <th>ct_srv_src</th>\n",
       "      <th>ct_state_ttl</th>\n",
       "      <th>ct_dst_ltm</th>\n",
       "      <th>ct_src_dport_ltm</th>\n",
       "      <th>ct_dst_sport_ltm</th>\n",
       "      <th>ct_dst_src_ltm</th>\n",
       "      <th>is_ftp_login</th>\n",
       "      <th>ct_ftp_cmd</th>\n",
       "      <th>ct_flw_http_mthd</th>\n",
       "      <th>ct_src_ltm</th>\n",
       "      <th>ct_srv_dst</th>\n",
       "      <th>is_sm_ips_ports</th>\n",
       "      <th>label</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>count</th>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.00000</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>82332.00000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>8.233200e+04</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "      <td>82332.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>mean</th>\n",
       "      <td>41166.500000</td>\n",
       "      <td>1.006756</td>\n",
       "      <td>18.666472</td>\n",
       "      <td>17.545936</td>\n",
       "      <td>7.993908e+03</td>\n",
       "      <td>1.323379e+04</td>\n",
       "      <td>8.241089e+04</td>\n",
       "      <td>180.967667</td>\n",
       "      <td>95.713003</td>\n",
       "      <td>6.454902e+07</td>\n",
       "      <td>6.305470e+05</td>\n",
       "      <td>4.753692</td>\n",
       "      <td>6.308556</td>\n",
       "      <td>755.394301</td>\n",
       "      <td>121.701284</td>\n",
       "      <td>6.363075e+03</td>\n",
       "      <td>535.180430</td>\n",
       "      <td>133.45908</td>\n",
       "      <td>1.084642e+09</td>\n",
       "      <td>1.073465e+09</td>\n",
       "      <td>128.28662</td>\n",
       "      <td>0.055925</td>\n",
       "      <td>0.029256</td>\n",
       "      <td>0.026669</td>\n",
       "      <td>139.528604</td>\n",
       "      <td>116.275069</td>\n",
       "      <td>0.094277</td>\n",
       "      <td>1.595372e+03</td>\n",
       "      <td>9.546604</td>\n",
       "      <td>1.369273</td>\n",
       "      <td>5.744923</td>\n",
       "      <td>4.928898</td>\n",
       "      <td>3.663011</td>\n",
       "      <td>7.456360</td>\n",
       "      <td>0.008284</td>\n",
       "      <td>0.008381</td>\n",
       "      <td>0.129743</td>\n",
       "      <td>6.468360</td>\n",
       "      <td>9.164262</td>\n",
       "      <td>0.011126</td>\n",
       "      <td>0.550600</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>std</th>\n",
       "      <td>23767.345519</td>\n",
       "      <td>4.710444</td>\n",
       "      <td>133.916353</td>\n",
       "      <td>115.574086</td>\n",
       "      <td>1.716423e+05</td>\n",
       "      <td>1.514715e+05</td>\n",
       "      <td>1.486204e+05</td>\n",
       "      <td>101.513358</td>\n",
       "      <td>116.667722</td>\n",
       "      <td>1.798618e+08</td>\n",
       "      <td>2.393001e+06</td>\n",
       "      <td>64.649620</td>\n",
       "      <td>55.708021</td>\n",
       "      <td>6182.615732</td>\n",
       "      <td>1292.378499</td>\n",
       "      <td>5.672402e+04</td>\n",
       "      <td>3635.305383</td>\n",
       "      <td>127.35700</td>\n",
       "      <td>1.390860e+09</td>\n",
       "      <td>1.381996e+09</td>\n",
       "      <td>127.49137</td>\n",
       "      <td>0.116022</td>\n",
       "      <td>0.070854</td>\n",
       "      <td>0.055094</td>\n",
       "      <td>208.472063</td>\n",
       "      <td>244.600271</td>\n",
       "      <td>0.542922</td>\n",
       "      <td>3.806697e+04</td>\n",
       "      <td>11.090289</td>\n",
       "      <td>1.067188</td>\n",
       "      <td>8.418112</td>\n",
       "      <td>8.389545</td>\n",
       "      <td>5.915386</td>\n",
       "      <td>11.415191</td>\n",
       "      <td>0.091171</td>\n",
       "      <td>0.092485</td>\n",
       "      <td>0.638683</td>\n",
       "      <td>8.543927</td>\n",
       "      <td>11.121413</td>\n",
       "      <td>0.104891</td>\n",
       "      <td>0.497436</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>min</th>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>2.400000e+01</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.00000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.00000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>24.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25%</th>\n",
       "      <td>20583.750000</td>\n",
       "      <td>0.000008</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.140000e+02</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>2.860611e+01</td>\n",
       "      <td>62.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.120247e+04</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.008000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.00000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>0.00000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>57.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50%</th>\n",
       "      <td>41166.500000</td>\n",
       "      <td>0.014138</td>\n",
       "      <td>6.000000</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>5.340000e+02</td>\n",
       "      <td>1.780000e+02</td>\n",
       "      <td>2.650177e+03</td>\n",
       "      <td>254.000000</td>\n",
       "      <td>29.000000</td>\n",
       "      <td>5.770032e+05</td>\n",
       "      <td>2.112951e+03</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.557928</td>\n",
       "      <td>0.010000</td>\n",
       "      <td>1.762392e+01</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>255.00000</td>\n",
       "      <td>2.788886e+07</td>\n",
       "      <td>2.856975e+07</td>\n",
       "      <td>255.00000</td>\n",
       "      <td>0.000551</td>\n",
       "      <td>0.000441</td>\n",
       "      <td>0.000080</td>\n",
       "      <td>65.000000</td>\n",
       "      <td>44.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>5.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>5.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>75%</th>\n",
       "      <td>61749.250000</td>\n",
       "      <td>0.719360</td>\n",
       "      <td>12.000000</td>\n",
       "      <td>10.000000</td>\n",
       "      <td>1.280000e+03</td>\n",
       "      <td>9.560000e+02</td>\n",
       "      <td>1.111111e+05</td>\n",
       "      <td>254.000000</td>\n",
       "      <td>252.000000</td>\n",
       "      <td>6.514286e+07</td>\n",
       "      <td>1.585808e+04</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>63.409444</td>\n",
       "      <td>63.136369</td>\n",
       "      <td>3.219332e+03</td>\n",
       "      <td>128.459914</td>\n",
       "      <td>255.00000</td>\n",
       "      <td>2.171310e+09</td>\n",
       "      <td>2.144205e+09</td>\n",
       "      <td>255.00000</td>\n",
       "      <td>0.105541</td>\n",
       "      <td>0.052595</td>\n",
       "      <td>0.048816</td>\n",
       "      <td>100.000000</td>\n",
       "      <td>87.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000e+00</td>\n",
       "      <td>11.000000</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>6.000000</td>\n",
       "      <td>4.000000</td>\n",
       "      <td>3.000000</td>\n",
       "      <td>6.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>7.000000</td>\n",
       "      <td>11.000000</td>\n",
       "      <td>0.000000</td>\n",
       "      <td>1.000000</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>max</th>\n",
       "      <td>82332.000000</td>\n",
       "      <td>59.999989</td>\n",
       "      <td>10646.000000</td>\n",
       "      <td>11018.000000</td>\n",
       "      <td>1.435577e+07</td>\n",
       "      <td>1.465753e+07</td>\n",
       "      <td>1.000000e+06</td>\n",
       "      <td>255.000000</td>\n",
       "      <td>253.000000</td>\n",
       "      <td>5.268000e+09</td>\n",
       "      <td>2.082111e+07</td>\n",
       "      <td>5319.000000</td>\n",
       "      <td>5507.000000</td>\n",
       "      <td>60009.992000</td>\n",
       "      <td>57739.240000</td>\n",
       "      <td>1.483831e+06</td>\n",
       "      <td>463199.240100</td>\n",
       "      <td>255.00000</td>\n",
       "      <td>4.294950e+09</td>\n",
       "      <td>4.294881e+09</td>\n",
       "      <td>255.00000</td>\n",
       "      <td>3.821465</td>\n",
       "      <td>3.226788</td>\n",
       "      <td>2.928778</td>\n",
       "      <td>1504.000000</td>\n",
       "      <td>1500.000000</td>\n",
       "      <td>131.000000</td>\n",
       "      <td>5.242880e+06</td>\n",
       "      <td>63.000000</td>\n",
       "      <td>6.000000</td>\n",
       "      <td>59.000000</td>\n",
       "      <td>59.000000</td>\n",
       "      <td>38.000000</td>\n",
       "      <td>63.000000</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>2.000000</td>\n",
       "      <td>16.000000</td>\n",
       "      <td>60.000000</td>\n",
       "      <td>62.000000</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.000000</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                ﻿id           dur         spkts         dpkts        sbytes  \\\n",
       "count  82332.000000  82332.000000  82332.000000  82332.000000  8.233200e+04   \n",
       "mean   41166.500000      1.006756     18.666472     17.545936  7.993908e+03   \n",
       "std    23767.345519      4.710444    133.916353    115.574086  1.716423e+05   \n",
       "min        1.000000      0.000000      1.000000      0.000000  2.400000e+01   \n",
       "25%    20583.750000      0.000008      2.000000      0.000000  1.140000e+02   \n",
       "50%    41166.500000      0.014138      6.000000      2.000000  5.340000e+02   \n",
       "75%    61749.250000      0.719360     12.000000     10.000000  1.280000e+03   \n",
       "max    82332.000000     59.999989  10646.000000  11018.000000  1.435577e+07   \n",
       "\n",
       "             dbytes          rate          sttl          dttl         sload  \\\n",
       "count  8.233200e+04  8.233200e+04  82332.000000  82332.000000  8.233200e+04   \n",
       "mean   1.323379e+04  8.241089e+04    180.967667     95.713003  6.454902e+07   \n",
       "std    1.514715e+05  1.486204e+05    101.513358    116.667722  1.798618e+08   \n",
       "min    0.000000e+00  0.000000e+00      0.000000      0.000000  0.000000e+00   \n",
       "25%    0.000000e+00  2.860611e+01     62.000000      0.000000  1.120247e+04   \n",
       "50%    1.780000e+02  2.650177e+03    254.000000     29.000000  5.770032e+05   \n",
       "75%    9.560000e+02  1.111111e+05    254.000000    252.000000  6.514286e+07   \n",
       "max    1.465753e+07  1.000000e+06    255.000000    253.000000  5.268000e+09   \n",
       "\n",
       "              dload         sloss         dloss        sinpkt        dinpkt  \\\n",
       "count  8.233200e+04  82332.000000  82332.000000  82332.000000  82332.000000   \n",
       "mean   6.305470e+05      4.753692      6.308556    755.394301    121.701284   \n",
       "std    2.393001e+06     64.649620     55.708021   6182.615732   1292.378499   \n",
       "min    0.000000e+00      0.000000      0.000000      0.000000      0.000000   \n",
       "25%    0.000000e+00      0.000000      0.000000      0.008000      0.000000   \n",
       "50%    2.112951e+03      1.000000      0.000000      0.557928      0.010000   \n",
       "75%    1.585808e+04      3.000000      2.000000     63.409444     63.136369   \n",
       "max    2.082111e+07   5319.000000   5507.000000  60009.992000  57739.240000   \n",
       "\n",
       "               sjit           djit         swin         stcpb         dtcpb  \\\n",
       "count  8.233200e+04   82332.000000  82332.00000  8.233200e+04  8.233200e+04   \n",
       "mean   6.363075e+03     535.180430    133.45908  1.084642e+09  1.073465e+09   \n",
       "std    5.672402e+04    3635.305383    127.35700  1.390860e+09  1.381996e+09   \n",
       "min    0.000000e+00       0.000000      0.00000  0.000000e+00  0.000000e+00   \n",
       "25%    0.000000e+00       0.000000      0.00000  0.000000e+00  0.000000e+00   \n",
       "50%    1.762392e+01       0.000000    255.00000  2.788886e+07  2.856975e+07   \n",
       "75%    3.219332e+03     128.459914    255.00000  2.171310e+09  2.144205e+09   \n",
       "max    1.483831e+06  463199.240100    255.00000  4.294950e+09  4.294881e+09   \n",
       "\n",
       "              dwin        tcprtt        synack        ackdat         smean  \\\n",
       "count  82332.00000  82332.000000  82332.000000  82332.000000  82332.000000   \n",
       "mean     128.28662      0.055925      0.029256      0.026669    139.528604   \n",
       "std      127.49137      0.116022      0.070854      0.055094    208.472063   \n",
       "min        0.00000      0.000000      0.000000      0.000000     24.000000   \n",
       "25%        0.00000      0.000000      0.000000      0.000000     57.000000   \n",
       "50%      255.00000      0.000551      0.000441      0.000080     65.000000   \n",
       "75%      255.00000      0.105541      0.052595      0.048816    100.000000   \n",
       "max      255.00000      3.821465      3.226788      2.928778   1504.000000   \n",
       "\n",
       "              dmean   trans_depth  response_body_len    ct_srv_src  \\\n",
       "count  82332.000000  82332.000000       8.233200e+04  82332.000000   \n",
       "mean     116.275069      0.094277       1.595372e+03      9.546604   \n",
       "std      244.600271      0.542922       3.806697e+04     11.090289   \n",
       "min        0.000000      0.000000       0.000000e+00      1.000000   \n",
       "25%        0.000000      0.000000       0.000000e+00      2.000000   \n",
       "50%       44.000000      0.000000       0.000000e+00      5.000000   \n",
       "75%       87.000000      0.000000       0.000000e+00     11.000000   \n",
       "max     1500.000000    131.000000       5.242880e+06     63.000000   \n",
       "\n",
       "       ct_state_ttl    ct_dst_ltm  ct_src_dport_ltm  ct_dst_sport_ltm  \\\n",
       "count  82332.000000  82332.000000      82332.000000      82332.000000   \n",
       "mean       1.369273      5.744923          4.928898          3.663011   \n",
       "std        1.067188      8.418112          8.389545          5.915386   \n",
       "min        0.000000      1.000000          1.000000          1.000000   \n",
       "25%        1.000000      1.000000          1.000000          1.000000   \n",
       "50%        1.000000      2.000000          1.000000          1.000000   \n",
       "75%        2.000000      6.000000          4.000000          3.000000   \n",
       "max        6.000000     59.000000         59.000000         38.000000   \n",
       "\n",
       "       ct_dst_src_ltm  is_ftp_login    ct_ftp_cmd  ct_flw_http_mthd  \\\n",
       "count    82332.000000  82332.000000  82332.000000      82332.000000   \n",
       "mean         7.456360      0.008284      0.008381          0.129743   \n",
       "std         11.415191      0.091171      0.092485          0.638683   \n",
       "min          1.000000      0.000000      0.000000          0.000000   \n",
       "25%          1.000000      0.000000      0.000000          0.000000   \n",
       "50%          3.000000      0.000000      0.000000          0.000000   \n",
       "75%          6.000000      0.000000      0.000000          0.000000   \n",
       "max         63.000000      2.000000      2.000000         16.000000   \n",
       "\n",
       "         ct_src_ltm    ct_srv_dst  is_sm_ips_ports         label  \n",
       "count  82332.000000  82332.000000     82332.000000  82332.000000  \n",
       "mean       6.468360      9.164262         0.011126      0.550600  \n",
       "std        8.543927     11.121413         0.104891      0.497436  \n",
       "min        1.000000      1.000000         0.000000      0.000000  \n",
       "25%        1.000000      2.000000         0.000000      0.000000  \n",
       "50%        3.000000      5.000000         0.000000      1.000000  \n",
       "75%        7.000000     11.000000         0.000000      1.000000  \n",
       "max       60.000000     62.000000         1.000000      1.000000  "
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# df.describe() calculates the count, mean, standard deviation, min, max, and quartiles \n",
    "# of the data less the nominal (object) columns. \n",
    "df.describe()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "proto:\n",
      "['udp' 'arp' 'tcp' 'igmp' 'ospf' 'sctp' 'gre' 'ggp' 'ip' 'ipnip' 'st2'\n",
      " 'argus' 'chaos' 'egp' 'emcon' 'nvp' 'pup' 'xnet' 'mux' 'dcn' 'hmp' 'prm'\n",
      " 'trunk-1' 'trunk-2' 'xns-idp' 'leaf-1' 'leaf-2' 'irtp' 'rdp' 'netblt'\n",
      " 'mfe-nsp' 'merit-inp' '3pc' 'idpr' 'ddp' 'idpr-cmtp' 'tp++' 'ipv6' 'sdrp'\n",
      " 'ipv6-frag' 'ipv6-route' 'idrp' 'mhrp' 'i-nlsp' 'rvd' 'mobile' 'narp'\n",
      " 'skip' 'tlsp' 'ipv6-no' 'any' 'ipv6-opts' 'cftp' 'sat-expak' 'ippc'\n",
      " 'kryptolan' 'sat-mon' 'cpnx' 'wsn' 'pvp' 'br-sat-mon' 'sun-nd' 'wb-mon'\n",
      " 'vmtp' 'ttp' 'vines' 'nsfnet-igp' 'dgp' 'eigrp' 'tcf' 'sprite-rpc' 'larp'\n",
      " 'mtp' 'ax.25' 'ipip' 'aes-sp3-d' 'micp' 'encap' 'pri-enc' 'gmtp' 'ifmp'\n",
      " 'pnni' 'qnx' 'scps' 'cbt' 'bbn-rcc' 'igp' 'bna' 'swipe' 'visa' 'ipcv'\n",
      " 'cphb' 'iso-tp4' 'wb-expak' 'sep' 'secure-vmtp' 'xtp' 'il' 'rsvp' 'unas'\n",
      " 'fc' 'iso-ip' 'etherip' 'pim' 'aris' 'a/n' 'ipcomp' 'snp' 'compaq-peer'\n",
      " 'ipx-n-ip' 'pgm' 'vrrp' 'l2tp' 'zero' 'ddx' 'iatp' 'stp' 'srp' 'uti' 'sm'\n",
      " 'smp' 'isis' 'ptp' 'fire' 'crtp' 'crudp' 'sccopmce' 'iplt' 'pipe' 'sps'\n",
      " 'ib']\n",
      "service:\n",
      "['-' 'http' 'ftp' 'ftp-data' 'smtp' 'pop3' 'dns' 'snmp' 'ssl' 'dhcp' 'irc'\n",
      " 'radius' 'ssh']\n",
      "state:\n",
      "['INT' 'FIN' 'REQ' 'ACC' 'CON' 'RST' 'CLO']\n",
      "attack_cat:\n",
      "['Normal' 'Reconnaissance' 'Backdoor' 'DoS' 'Exploits' 'Analysis' 'Fuzzers'\n",
      " 'Worms' 'Shellcode' 'Generic']\n"
     ]
    }
   ],
   "source": [
    "# List the unique values of each nominal column\n",
    "header = df.columns.values.tolist()\n",
    "for column in header:\n",
    "    if column in df.select_dtypes(include=[\"object\"]):\n",
    "        print column + \":\\n\", df[column].unique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# Ravi\n",
    "# Boxplots"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Verify data quality: Explain any missing values, duplicate data, and outliers.\n",
    "    - Are those mistakes? How do you deal with these problems? Be specific."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# Daniel\n",
    "# is_ftp_login\n",
    "# mention ID feature\n",
    "\n",
    "# Ravi \n",
    "# pick out the box plots with outliers"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###  Give simple, appropriate statistics (range, mode, mean, median, variance, counts, etc.) for the most important attributes and describe what they mean or if you found something interesting. \n",
    "    - Note: You can also use data from other sources for comparison. Explain the significance of the statistics run and why they are meaningful. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# Daniel \n",
    "# explain the five we chose"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Visualize the most important attributes appropriately (at least 5 attributes).\n",
    "    - Important: Provide an interpretation for each chart. Explain for each attribute why the chosen visualization is appropriate. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# Boxplots - Ravi each of the five by attack label\n",
    "# other visualizations as found"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Explore relationships between attributes: Look at the attributes via scatter plots, correlation, cross-tabulation, group-wise averages, etc. as appropriate. \n",
    "    - Explain any interesting relationships."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# Heat plots"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Identify and explain interesting relationships between features and the class you are trying to predict (i.e., relationships with variables and the target classification)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# Randy\n",
    "\n",
    "#positive correlation:\n",
    "#    sttl : 0.5\n",
    "#    ct_dst_sport_ltm : 0.39\n",
    "#    ct_src_dport_ltm : 0.34\n",
    "#negative correlation:\n",
    "#    swin : 0.41\n",
    "#    dwin : 0.37"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Randy - Do additional visualization to find something interesting\n",
    "When it is attack, the swin value is either 0 or 255, where as normal traffic has ranges between 0 and 255 inclusive.\n",
    "    - 30k attack records when swin/dwin is 0\n",
    "    - 15k attack records when swin/dwin is 255\n",
    "    \n",
    "Next break down by attack categories - most are the generic category *(cipher attack)*"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    " ### Are there other features that could be added to the data or created from existing features? Which ones? "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "# team "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAXUAAAECCAYAAAAB2kexAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz\nAAALEgAACxIB0t1+/AAADnVJREFUeJzt3X+snfVdwPH3bW+L7TwtTTx0zi0SF/lUfm0DBSGMMqUb\nTTSwZMaYoM7NdiOlGUvGH3QyoskdRF0xHXEa6GhiZpbRANMRhCgE2mUy6FhCt/qhc2QSlfRi+tNm\nay+9/nFOk7t67z33OT2nhc99vxLCuc+P8/02ffo+3/vcntORyclJJEk1LDjbE5AkDY5Rl6RCjLok\nFWLUJakQoy5JhRh1SSpktNcBEbEAuB8I4ATwSeAnwLbu17szc0P32HXAeuA4MJaZjw1n2pKk6cxl\npf7bwGRmXgPcCXwe2AxsyszVwIKIuDEiVgIbgauAG4C7I2LRkOYtSZpGz6hn5tfprL4BfhHYD1yW\nmTu62x4H1gBXADszcyIzDwF7gUsHP2VJ0kzmdE89M09ExDZgC/D3wMiU3YeBZUALODhl+xFg+WCm\nKUmaizn/oDQzPwpcADwALJmyqwUcAA7Rifup2yVJZ8hcflB6M/DOzLwH+DHwBvBCRKzOzGeAtcBT\nwPPAWEQsphP9VcDu2Z57YuKNydHRhaf5S5CkeWdkxh29PtArIpYCDwJvp/MicDfwb3RW7IuAPcC6\nzJyMiI8Dn+gOOJaZj8723OPjh/00sQFqt1uMjx8+29OQ/h+vzcFqt1v9R32YjPpg+QdHb1Zem4M1\nW9R985EkFWLUJakQoy5JhRh1SSrEqEtSIUZdkgox6pJUiFGXpEKMuiQVYtQlqRCjLkmFGHVJKsSo\nS1IhRl2SCjHqklSIUZekQoy6JBVi1CWpEKMuSYUYdUkqxKhLUiFGXZIKMeqSVIhRl6RCjLokFWLU\nJakQoy5JhRh1SSrEqEtSIaOz7YyIUeDLwPnAYmAMeBX4BvBy97AvZeZDEbEOWA8cB8Yy87FhTVqS\nNL1Zow7cDLyemX8QESuA7wJ/CnwhM+89eVBErAQ2ApcBS4GdEfFkZh4f0rzLe/3tV/ErJ77X+Lx2\ng2P3LLiIn3vtW43HkPTm1SvqXwMe6j5eQGcVfjmwKiJuorNa/zRwBbAzMyeAQxGxF7gU2DWUWc8D\nF57Yzb59hxud0263GB+f+zkXntdiH83GkPTmNmvUM/MoQES06MT9T4BzgAcy88WIuAO4i84K/uCU\nU48Ay4cyY0ln3QUX/CwHDoxMs+dioMl3mBcBu6fdc+65k7z88pE+Zje/9VqpExHvAh4G7svMr0bE\n8sw8GfBHgS3AM8CyKae1gAODnqykN4cDB0Zm+E5y+tt5s38XOf32885r9Te5eW5kcnJyxp3de+VP\nAxsy8+nutn8Fbs3MFyLiVuCdwL3Ak8CvAUvo/M6+NzOPzTb4xMQbk6OjCwfyC6lmZARm+a15y4yh\nmrw+z7rpvk0Ceq/U7wDOBe6MiM8Bk3Tuof9VRBwDXgPWZ+aRiNgC7OwOtqlX0AH27z86x/nPR83u\nj0Pze+r9jCF1NLt2ml+bzceYT9rtmb+L6XVP/Tbgtml2XTPNsVuBrU0nJ0kaHN98JEmFGHVJKsSo\nS1IhRl2SCjHqklSIUZekQoy6JBVi1CWpEKMuSYUYdUkqxKhLUiFGXZIKMeqSVIhRl6RCjLokFWLU\nJakQoy5JhRh1SSrEqEtSIUZdkgox6pJUiFGXpEKMuiQVYtQlqRCjLkmFGHVJKsSoS1IhRl2SCjHq\nklSIUZekQkZn2xkRo8CXgfOBxcAY8H1gG3AC2J2ZG7rHrgPWA8eBscx8bGizliRNq9dK/Wbg9cy8\nFrgBuA/YDGzKzNXAgoi4MSJWAhuBq7rH3R0Ri4Y4b0nSNGZdqQNfAx7qPl4ITACXZeaO7rbHgQ/S\nWbXvzMwJ4FBE7AUuBXYNfsqSpJnMGvXMPAoQES06cf8s8JdTDjkMLANawMEp248Aywc6U0lST71W\n6kTEu4CHgfsy86sR8edTdreAA8AhOnE/dfusVqxYyujowmYznkfa7dbQz+lnDAnOzLXm9dlcrx+U\nrgSeADZk5tPdzS9GxLWZ+SywFngKeB4Yi4jFwBJgFbC71+D79x89nbkX12J8/HCjM9rtpuc0H0Pq\naHbtNL82m48xn8z2YtdrpX4HcC5wZ0R8DpgEPgV8sfuD0D3A9sycjIgtwE5ghM4PUo8NYvKSpLnr\ndU/9NuC2aXZdN82xW4Gtg5mWJKkfvvlIkgox6pJUiFGXpEKMuiQVYtQlqRCjLkmFGHVJKsSoS1Ih\nRl2SCjHqklSIUZekQoy6JBVi1CWpEKMuSYUYdUkqxKhLUiFGXZIKMeqSVIhRl6RCjLokFWLUJakQ\noy5JhRh1SSrEqEtSIUZdkgox6pJUiFGXpEKMuiQVYtQlqZDRuRwUEVcC92TmByLivcA3gJe7u7+U\nmQ9FxDpgPXAcGMvMx4YyY0nSjHpGPSJuB34fONLddDnwhcy8d8oxK4GNwGXAUmBnRDyZmccHP2VJ\n0kzmslL/AfBh4O+6X18OXBARN9FZrX8auALYmZkTwKGI2AtcCuwa/JQlSTPpeU89Mx8BJqZseg64\nPTNXAz8E7gKWAQenHHMEWD7AeUqS5mBO99RP8Whmngz4o8AW4Bk6YT+pBRzo9UQrVixldHRhH1OY\nH9rt1tDP6WcMCc7Mteb12Vw/UX8iIm7NzBeA36Rzi+V5YCwiFgNLgFXA7l5PtH//0T6Gny9ajI8f\nbnRGu930nOZjSB3Nrp3m12bzMeaT2V7s+on6LcAXI+IY8BqwPjOPRMQWYCcwAmzKzGP9TFaS1L85\nRT0zfwRc3X38InDNNMdsBbYOdHaSpEZ885EkFWLUJakQoy5JhRh1SSrEqEtSIUZdkgox6pJUiFGX\npEKMuiQVYtQlqRCjLkmFGHVJKsSoS1IhRl2SCjHqklSIUZekQoy6JBVi1CWpEKMuSYUYdUkqxKhL\nUiFGXZIKMeqSVIhRl6RCjLokFWLUJakQoy5JhRh1SSrEqEtSIaNzOSgirgTuycwPRMS7gW3ACWB3\nZm7oHrMOWA8cB8Yy87HhTFmSNJOeK/WIuB24Hzinu2kzsCkzVwMLIuLGiFgJbASuAm4A7o6IRUOa\nsyRpBnO5/fID4MNTvr48M3d0Hz8OrAGuAHZm5kRmHgL2ApcOdKaSpJ56Rj0zHwEmpmwamfL4MLAM\naAEHp2w/AiwfxAQlSXM3p3vqpzgx5XELOAAcohP3U7fPasWKpYyOLuxjCvNDu90a+jn9jCHBmbnW\nvD6b6yfq34mIazPzWWAt8BTwPDAWEYuBJcAqYHevJ9q//2gfw88XLcbHDzc6o91uek7zMaSOZtdO\n82uz+RjzyWwvdv1E/TPA/d0fhO4BtmfmZERsAXbSuT2zKTOP9TNZSVL/5hT1zPwRcHX38V7gummO\n2QpsHeTkJEnN+OYjSSrEqEtSIUZdkgox6pJUiFGXpEKMuiQVYtQlqRCjLkmFGHVJKsSoS1IhRl2S\nCjHqklSIUZekQoy6JBVi1CWpEKMuSYUYdUkqxKhLUiFGXZIKMeqSVIhRl6RCjLokFWLUJakQoy5J\nhRh1SSrEqEtSIUZdkgox6pJUiFGXpEJG+z0xInYBB7tfvgJ8HtgGnAB2Z+aG056dJKmRvlbqEXEO\nQGb+Rve/jwObgU2ZuRpYEBE3DnCekqQ56Hel/h7gbRHxBLAQ+CxwWWbu6O5/HFgDfP30pyhJmqt+\n76kfBf4iMz8E3AJ8BRiZsv8wsPw05yZJaqjfqL9MJ+Rk5l7gf4CVU/a3gAOnNzVJUlP93n75GHAJ\nsCEi3gEsA56MiNWZ+QywFniq15OsWLGU0dGFfU6hvna7NfRz+hlDgjNzrXl9Ntdv1LcCD0bEDjp/\n2+WjdFbrD0TEImAPsL3Xk+zff7TP4eeDFuPjhxud0W43Paf5GFJHs2un+bXZfIz5ZLYXu76inpnH\ngZun2XVdP88nSRoM33wkSYUYdUkqxKhLUiFGXZIKMeqSVIhRl6RCjLokFWLUJakQoy5JhRh1SSrE\nqEtSIUZdkgrp+98olTR/vcTFtM/7XqNz2o3HuAj4VsOzZNQlNXYJu9m3b7gfvXvJeS324UfvNuXt\nF0kqxKhLUiFGXZIKMeqSVIhRl6RCjLokFWLUJakQoy5JhRh1SSrEqEtSIUZdkgox6pJUiFGXpEKM\nuiQVYtQlqZCBfp56RIwAfw28B/gx8MeZ+cNBjiFJmtmgV+o3Aedk5tXAHcDmAT+/JGkWg476NcA/\nAWTmc8CvDvj5JUmzGHTUlwEHp3w9ERHet5ekM2TQwT0EtKY+f2aeGPAYkqQZDPofnv4m8FvA9oj4\ndeCl2Q5ut1sjAx6/jMlJ+OnXx7lpt+d+Tr9jSP1cO02uzX7H0OCj/giwJiK+2f36jwb8/JKkWYxM\ndl4OJUkF+ENMSSrEqEtSIUZdkgox6pJUiFEvKCK2n+05SBFxTkS8EhEXRcT7u9veHxEXdx//99md\nYU1GvaDM/MjZnoMEnHwfykeAC7uPPwa8o/vYv3o3BIP+e+oagoj4ZeBB4DiwEJgAPpOZ34mIPcAd\nmfloRDxB570BuzLz5yPiaeC7wMV03sXxO5n56tn5VWg+iIi3AV8BzgX+HfgF4A+BYxHxInAD8L7u\ndashcKX+1rAGeA64HrgLeApYGxHnAz8Bro+IZXQ+IfO/+OkV0HOZuQb4Z+D3zuisNR99EngpM68D\n/hb4T2AbsDkzv03nA/9u7y4ufEf5EBj1t4atdD4o7QlgA51AfxD4EHAPcCWwFvjHac59sfv/V4Gf\nGfpMNd9dAHwboBvx49McczLm3n4ZAqP+1nAjsCMzrwe2A+uB/wV+l87K5z+ATwEPT3Ouf3B0Jn0f\nuBogIt4HLAJO0LltSPfxye64Uh8Co/7W8ALwZxHxL8AngC3APwBLM/MAnRX8ksx85ZTzDLrOtL8B\nfikingVuofMvoO0CNkTEajq3Ee+JiFV4fQ6Fn/0iSYW4UpekQoy6JBVi1CWpEKMuSYUYdUkqxKhL\nUiFGXZIKMeqSVMj/ASUvfxcocgH2AAAAAElFTkSuQmCC\n",
      "text/plain": [
       "<matplotlib.figure.Figure at 0xc36ef60>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "plt.boxplot(x=[df.swin, df.dttl], labels=[\"swin\", \"dttl\"])\n",
    "plt.show()"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python [Root]",
   "language": "python",
   "name": "Python [Root]"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.11"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 0
}
